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TELECOMMUNICATIOMS SYSTEM 

This invention relates to a telecommunications system. 
In particular, but not exclusively, it relates to a mobile 
5 communications system such as a cellular mobile radio or 
telephone system. 

A recent innovation in such systems has been the ^ 
introduction of Subscriber Identity Modules (SIM cards) . 
These are integrated circuit cards which can be releasably 

10 inserted into a mobile telephone and which contain in 
memory the subscriber's identity, i.e. his telephone 
number. These known SIM cards also have a rolling buffer J 
which can store a certain number of alphanumeric 
characters. The buffer facilitates the so-called Short 

15 Message Service (SMS) in which a message for a subscriber 
or for a specified group of subscribers can be broadcast 
over the air, as an advanced form of radiopaging. Messages 
can be received by a mobile telephone whenever it is idle 
or on stand-by. However, if a message is received which 

20 would overfill the buffer, data is lost on a 
first-in-first-out basis. 

It is an object of the invention to provide a more 
efficient and remotely reconf igurable SIM card. 

From one aspect, the present invention consists in a 

25 telecommunications system comprising at least one host 

station and a plurality of subscriber units, the or each C 
host station being operable to transmit a message to at ( 
least one of the subscriber units, and each subscriber unit ^> 
having a multiplicity of fixed memory locations and means 

30 responsive to the detection of the message to store the 
message in a selected one of the fixed memory locations 
which can not be overwritten from the subscriber unit, but 
which can be accessed from the subscriber unit when 
required. 

35 In this description and the accompanying claims, a 

"fixed" memory location means a location into which data 
can be written, and excludes first-in-first-out or circular 
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buffers. Overwriting of all the data in certain "fixed" 
memory locations may occur in contrast to the first-in- 
first-out loss of data experienced with current SMS 
buffers* 

5 Thus, for example, a set of telephone numbers, each 

with an identifying alphanumeric tag, can be transmitted to 
the SIM card, allowing users easy access to commonly used 
services such as hotels, car hire or airline reservations. 
This feature is known as a Value Added Service Directory. 

10 A message may be retrievable by the subscriber on the 

entry of simple, short codes into the subscriber unit, each 
memory location corresponding to a particular code. A 
message may include a telephone number and, once stored, 
may be able to be overwritten over the air. Preferably, the 

15 or each host station is operable to transmit a request for 
information stored in a subscriber unit. The information 
may be included in a message and it may also include 
information which is stored in a secure memory location, 
accessible only when the subscriber enters a personal 

20 identification number (PIN number). The information may 
a include credit details relevant to the subscriber, for 
example, a credit card number of credit status, thus 
, greatly facilitating credit card transactions carried out 
I over the telephone. Using this feature of the invention, 

25 a credit account holder avoids having to dictate his 
account details and need only enter the mandatory PIN 
number . 

The host station may be operable to transmit 
instructions to lock and/or unlock a memory location at the 

30 subscriber unit. It may be operable to transmit 

instructions to run a program stored in memory locations at 
the subscriber unit. The host station may be operable to 
transmit files containing functional data and/or files 
containing non- functional data to the subscriber unit. 

35 The messages, requests for information and the 

instructions being transmitted may be in a specific format 
which the subscriber unit is able to distinguish from other 
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formats. The specific format may be made secure against 
interception. 

In a preferred embodiment, the subscriber unit ^ 
comprises a mobile radio or telephone and an integrated 
circuit card which can be removably connected to the radio/ 
telephone. The integrated circuit card may contain the 
memory locations and may contain means for distinguishing 
the specific format from other formats. The card may 
contain means for distinguishing between the messages, ^ 
requests for information and instructions. The card may 
also contain the means for storing the messages and means 
for acting on the requests and instructions. 

From another aspect, the invention consists in a 
module for controlling a subscriber unit in a 
15 telecommunications system, comprising a multiplicity of 
fixed memory locations and means responsive to the 
detection of a message transmitted remotely thereto to 
store the message in a selected one of the fixed memory 
locations, and being adapted for removable connection to a 
transceiver of the subscriber unit. 

At least one of the fixed memory locations may be 
protected from overwriting by the subscriber. The module 
or card may include means for rendering any or all of said 
fixed memory locations accessible or inaccessible by either 
25 the subscriber or the host station. The card may include 
a directory structure within which files can be stored. 

The invention is particularly applicable to global 
telecommunication systems in which the mobile cellular 
telephone networks of various countries or areas 
30 communicate using a common standard. An example of such a • 
global system is GSM (Global System for Mobile 
Communications) currently operating in Europe. However the 
invention is not limited to global systems and could be 
applied to a single national cellular network or even to a 
35 fixed land-linked network. 

An embodiment of the invention will now be described 
by way of example with reference to the accompanying 
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drawings in which 

Figure 1 shows the transmission of messages to a 
subscriber unit in a system according to the invention; 

Figure 2 shows a process in which a subscriber unit 
5 transmits a message and requested information; 

Figure 3 is a block diagram showing elements of a 
module shown in figures 1 and 2; 

Figure 4 shows details of one of the blocks shown in 
figure 3 ; and 

10 Figure 5 is a flowchart showing the operation of the 

module shown in figures 1 to 4 . 

Figure 1 illustrates an SMS distribution path 
according to the invention. In the prior art, the short 
messages have usually been directed to a single subscriber 

15 or a specified group of subscribers such as a sales team. 

However, GSM also supports a feature known as Cell 
Broadcast in which messages can be sent to all the 
subscribers in a particular area. In the embodiment of the 
invention illustrated, a message consists of the telephone 

20 number of an advertiser and an alphanumeric tag to identify 
the advertiser. 

An operator enters the message into a terminal 1. The 
message is then coded into a secure format known as an 
Embedded Command Stream (ECS) and sent via a modem 2 and a ( 

25 fixed line 3 to a local GSM switch 4. According to its 
delivery address, the message is delivered to any or all of 
the other switches within that network, or even across \ 
networks . ^ 
The switch 4, which in this example is in the N 

30 geographical area to which the message is to be ( 
transmitted, delivers the message to a number of cellsites 
5. The cellsites 5 are the base transceiver stations of \ 
the GSM network. 

Each cells ite 5 then broadcasts the message to a group 

35 of transceivers or mobile telephones, hereinafter referred 
to as "mobiles". If Cell Broadcast is used, the group 
consists of all mobiles within the geographical area at the 
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time of the broadcast. 

A selected mobile 6 receiving the message transmits a 
confirmation of receipt back to its respective cellsite 5 
From now on, until an update situation, the system will not 
contact this mobile 6 again. 

The mobile 6 recognises the message as SMS data and 
passes it to a SIM card 7, which is a small self-contained 
microprocessor, held in a slot in the mobile 6. The SIM 
card 7 in turn recognises the ECS using special hardware 
and software and stores the message in memory in such a way 
that it may not be overwritten by the subscriber. Known 
SIM cards contain a large number of fixed memory locations 
xn which the subscriber can store frequently dialled 
numbers and corresponding alphanumeric tags. The SIM card 
7 of the invention stores the message in one of these 
locations, and then carries out a write protect operation. 
The locations dedicated to storing write protected messages 

2V*l^ S T a T ^ COdS nUmb6rS relat±ng t0 a P~ticular 
category of advertiser. Thus, for example, car hire 

company telephone numbers can be stored in location 01, 
hotel reservations in location 02 and so on. 

subscrT" 2 Sh ° WS 3 Cal1 PlaCing Pr ° CeSS in * 
subscriber communicates with an ari,,-^- • 

witn an advertiser. The 
subscrber remembering that the car „ ire c . s ^ 

r l0 !" i0n 01 as sho - « Keys in a short code 
correspond to the location, such as 01#. The mobile 6 
then interrogates the SIM card 7 to retrieve the telephone 
number from the location. The SIM card 7 provides both t" 
number and the alphanumeric tag giving the company- s name 
and displays it to the subscriber. The user confirms that 
he wishes to proceed by pressing SEND. 

the B "T' ^ m ° bile ° btainS * V ° iCe Channsl th «»9" "hich =» 
the call proceeds to the dialled number. The GSM system 

automatically handles intra-netwo^v =„h 7 

... ,.„. . network and inter-network hops. 

At this point the subscriber ca , h „i rf 

with the company. V ° 1Ca « nve ««"<> 

Providing the correct equipment has been installed at 



WO 94/30023 



PCT/GB94/01295 



-6- 

i the company, as soon as the call is answered, subscriber 
j identity information read from the SIM card 7 gives the 
j company immediate customer billing details such as a name 
I and address. 

5 The SIM card 7 also contains information detailing the 

subscriber's credit account. This information is held in 
a separate, secure memory location, accessible only when 
the subscriber enters a mandatory PIN number, known only to 
himself, thus confirming that the mobile has not been 
10 stolen or lost. When the subscriber has confirmed his car 
hire deal, he enters the PIN number into the mobile 6, 
requesting the credit information from the SIM card 7_. The 
SIM card 7 supplies the information and the mobile uses 
existing voice/data techniques to transmit the information 
15 to the company, in a format secure against detection by 
fraudsters. The sale is confirmed by the company or its 
equipment and the call is terminated. 

In this example, it is also possible to obtain a 
telephone or fax number from the operator-assisted 
20 directory enquiries system without the subscriber having to 
manually enter the number into the communications terminal 
which he desires to use. 

To use this feature, the subscriber calls network 
directory enquiries and gives the name of the person, 
25 company or service of which he wishes to ascertain the 
telephone number, as well as any additional information 
requested by the operator answering the call. The operator 
then locates the number, confirms it and enquires as to 
whether the number is to be transmitted verbally, 
30 transferred over SMS into a given memory location of the 
subscriber's SIM card or both. 

If the subscriber chooses a SIM update, the voice call 
is terminated and the operator initiates the SMS process by 
entering a sequence into a computer or pressing a dedicated 
35 button. The telephone number is then encoded into an ECS ( 
message at the despatch centre and is posted across the C 
network to the subscriber's communications terminal, which y 
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transmits a confirmation to the despatch centre. Thus the 
retry mechanism, which operates until such a confirmation 
is received, is suspended. 

The communications terminal recognises the message as 
5 SMS data, passes it to the SIM card, and if capable, 
displays a "message received" banner. The SIM card in turn 
recognises the ECS using special hardware and software, and 
decodes it accordingly. The number, and any associated 
alphanumeric tag, which would normally consist of the name 

10 of the person or company, are recovered together with the 
memory location in which they are intended to be stored. 
The number and name-tag are then written to that location 
and are write-protected if requested by the subscriber, the 
overwrite protection being encoded into the message at 

15 source. 

Subsequently, the subscriber attempts to place a call 
to the number in the known memory location by keying in the 
memory location number. The SIM card passes the telephone 
or fax number to the communications terminal on demand, and 
20 upon receipt of the subscriber's confirmation, the 
communications terminal sets up the call to the desired 
number . 

Figure 3 shows the electronic structure of the SIM 
card 7 . The card communicates with the mobile to which it 

25 is connected via an input/output (I/O) manager 15, 
preferably using the protocol ISO 7816 T=0 . A filter 16 
receives incoming data from the I/O manager and detects any 
ECS messages from among the short messages received. The 
ECS messages are sent directly to an extended erasable read 

30 only memory ( E 2 ROM ) 17, which is preferably a "flash" 
E 2 ROM . Data can also be output from the E 2 ROM directly to 
the I/O manager 15. The remaining blocks shown in figure 
3 are standard components of a SIM card. 

Figure 4 shows how the E 2 ROM is organised. A root 

35 directory 18 contains a SIM administration and identifier 
19, a GSM directory and network data 20, and a telecom 
directory 21. 
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The telecom directory in turn contains memory 
locations as follows: "abbreviated dial numbers" 22, 
"capability configuration" 23, "short messages" 24, "fixed 
dial numbers" 25, and "charging counter" 26* Each block 
5 represents a plurality of memory locations. The frequently 
dialled numbers and corresponding alphanumeric tags are 
stored at locations 22. 

The "abbreviated dial numbers" locations 22 and the 
"short messages" locations 24 each have an associated 
10 locking control file 27, 28 respectively. The locking 
control files constitute means for read/write protecting 
and removing read/write protection from their associated 
memory locations. The locking control files 27, 28 will 
typically be in the telecom directory 21 as shown, however 
15 they can be located elsewhere such as in an administration 
directory . 

Figure 5 is a flowchart illustrating the operation of 
the SIM card 7, which uses the specially fabricated 
hardware and software which has been described above to 

20 implement the operations illustrated. At lozenge 9, 
messages, requests, and instructions having ECS are 
distinguished from those without. Each of these ECS types 
consists of a data stream headed by a command which is one 
of at least four types: write commands for the messages, 

25 read commands for the requests for information, attribute 
commands for lock or unlock instructions and run commands 
for instructions to run a program. 

The command and data types are decoded at box 10 and 
acted on in one of the four paths 11-14. 

30 Path 11 handles the write commands to store messages 

starting at a location specified therein. Path 12 handles 
the read commands; again, the requests for information 
contain a location to be accessed first. Successive 
locations are read and the data stored in a buffer until 

35 the required amount of data has been read. The data in the 
buffer is then encoded into the ECS format and despatched 
from the mobile using SMS to the calling party. 
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In path 13, attribute commands are used to lock or 
unlock specified memory locations and render them 
accessible or inaccessible, either to calling parties or to 
the subscriber. In path 14, run commands cause a program 
5 stored in the SIM card to be run. 

The basic ECS system is expandable to up to 255 
internal shell commands of which write, read, lock/unlock 
and run are four examples. The specific protocol used for 
the transfer of information is not fixed and could be 

10 IS07816 T=0 or any other suitable protocol. 

The internal shell commands are a supplement to the 
ability of the system to create external file objects 
within the SIM card 7. The file objects are of two types: 
Application Data File Programs (ADFP's) containing 

15 functional data which can be executed by the SIM card 
processor and can self modify if required and Application 
Data Files (ADF's) containing non- functional data which 
does not have these capabilities. Existing ADF(P)'s can be 
modified over-the-air enabling advanced facilities such as 

20 personalisation, re-personalisation or downloadable phone 



The SIM card 7 has a directory structure, similar to 
that of a computer disk, and new ADF(P)'s can be downloaded 



25 directories can be created, deleted and modified, multiple 
tree directory operations can be carried out and ADF(P)'s 
that are no longer required can be deleted. The amount of 
ADF{P) data which can be downloaded is limited only by the 
size of the E 2 ROM memory of the card. 

30 The invention, as described, greatly extends the 

applications of SIM cards. For example, using the Value 
Added Services Directory, subscribers can book hotels and 
airline seats over their mobiles quickly and easily. 



in a specific area such as the South of France is 
facilitated. Thus advertisers can direct their messages to 



book. 



into any directory over the air. 



Also over the air , 



35 



An additional advantage of this feature of invention 
is that the geographical distribution of messages to cards 
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all mobile subscribers in the specific area. This is 
particularly useful when subscribers "roam" from one area 
to another and have no knowledge of local services. 

The directory enquiries download enables contact 
telephone or fax numbers to be delivered to a subscriber's 
communications terminal without any intervention by the 
subscriber. The process of manually entering a number 
whilst engaged in a call to the operator is often 
dangerous, especially when the subscriber is driving. 

The ability of the system to download ADF(P)'s means 
j f that additional services can be added to the SIM card oyer 

\\ the air while maintaining total compatibility with the 

'j existing cellular system. Thus the SIM card could acquire ^ 
j the £ u ^J^ ons of a credit card, passport, driving licence, 
5 ar P ark pass, membership card and so on, becoming a multi- 
U?. ervice card. Also, dynamically updatable services can be 
1 added which require a different process to be run each time 
a service is accessed. 

Once the card has extra services on it, it can be used 
_°^ side of the mobile phone environment if desired as a 
standalone item. This can be read from or written to by a 
dedicated piece of hardware, such as a point of sale 
| machine. If desired, the new services can be deleted, 
however the card will never lose its mobile phone SIM 
25 capability. In addition, if the card has extra services, 
they will continue to function even if the subscriber has 
been disconnected from the mobile phone network, unless 
otherwise desired* 

Modifications are possible without departing from the 
30 scope of the invention. 

For example, the SIM card can be trained only to 
receive messages detailing services relevant to the 
subs cr iber ' s needs . 
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CLAIMS 

;r.\ r.«-::r:; r - ; 

subscriber unit tc n ^ u • ' r units ' and each 

iDer unit (6,7) having a raultinlirii-v *• 
-cations (M) and raeans rjp^^t ~ 
message to store the me ssage in a s^ c ,TZ ^ £ 
f.xed mem0 ry locations which can not be overwritten f 
the subscriber unit ffi 71 h «. w overwritten from 

(6 ' 7) ' but which can be accessed from 
the subscriber unit when required. 

2. A system as claimed in claim 1, wherein at least 
one of the subscriber units ffi 7,, ' rSin at least 
, 6 , anH , . itS (6 ' 7 > comprises a transceiver 

(6) and an integrated circuit mt-h 

having the f ix L (?) - ° r ° ther modu - 

«g tne fixed memory locations (22\ *t,h 

responsive to the detection of , meanS 

to route it to J. 1 meSSa9S ^ transceiv ^ 

it to the selected fixed memory location «= „ 
— .1. being removaWy connectea ^ thfi ^ 

jr ^"-auon (22) is associated with - 
code and w Wltn a simple, short 

r esP :„ s r ve to th." r iber unit (s ' 7) inciudes — - 

retrieve dat " f ^ lnt ° «*" ° f «* «— to 

. V 3 " £r ° m the «*°«ated memory location. 

subscriber unit (6,7). cation (22) at each 

(24, within a selected one " """""^ loMti ™ 

and each subscriber u ni t briber units (6,7), 

a request » U " lt <=°"ains means responsive to such 

request for retrieving and transmitting the information 
6- A system as claimed in claim ^ „ • "Un- 
responsive to the request is actuated , "** "** "" 
a personal identification a " U " ed onl r °" tha e «rY of 
oentification number (Pim number) into the 
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subscriber unit (6,7). 

7. A system as claimed in any preceding claim, wherein 
the subscriber unit (6,7) has a multiplicity of further 
fixed memory locations which can be overwritten from the 

5 subscriber unit (6,7). 

8. A system as claimed in any preceding claim, wherein 
each subscriber unit (6,7) includes means (27, 28) 
responsive to an instruction transmitted from the or each 
host station (1) selectively to enable or prohibit said 

10 further fixed memory locations to be overwritten from the 
or each host station (1) or from the subscriber unit (6,7). 

9. A system as claimed in any preceding claim, wherein 
each subscriber unit (6,7) includes means responsive to an 
instruction transmitted from the or each host station (1) 

15 to run a program stored in said fixed or further fixed 
memory locations at the subscriber unit (6,7). 

10. A system as claimed in claim 8 or 9, when 
dependent upon claim 5, wherein the or each message, 
request for information and instruction transmitted is in 

20 a specific format, and the subscriber unit (6,7) includes 
means (16) for recognising the specific format. 

11. A system as claimed in one of claims 3 to 10, when 
dependent upon claim 2, wherein the module (7) includes the 
means responsive to the detection of a message to store the 

25 message in a selected one of the fixed memory locations, 
and/or the means responsive to the entry of a simple short 
code to retrieve data from the associated memory location, 
and/or the means responsive to a request for information to 
retrieve and transmit the information, and/or the 

30 multiplicity of further fixed memory locations which can be 
overwritten by the subscriber, and/or the means for 
selectively enabling or prohibiting said further fixed 
memory locations to be overwritten, and/or the means for 
running a program, and/or the means for recognising the 

35 specific format. 

12. A module (7) for controlling a subscriber unit in 
a telecommunications system, being removably connected to 
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a transceiver (6) of the subscriber unit a „H 
multiplicity of fixed memory lo »H - - - . 

responsive to the detection o £ a message ,r^Z 

remotely therPtn ^ transmitted 

= - fi j d L°d:::: s : he raessa9e in a seiectM - - 

or the Hxed memory locations (22, 24) (. 
protected from overling from the subscriber unit 

10 including means ,27, 28, for rendering any or ail of J ^ 
fixed memory locations accessible or inaccessible 7 
either the subscriber unit or the host station ' ^ 
A «>°dule (7) as claimed in claim 12, 13 or 14 

* >7i:z:v directory st — «»' — — 

circuit card. f an inte grated 
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